Updating the upstream module hash on push

Author: gregorydlogan

.github/workflows/deploy-main-branches.yml

@@ -1,5 +1,6 @@
 name: Build » Deploy main branches
 
+# NOTE: This should *not* run on tags, these are handled in the main repo
 on:
   push:
     branches:
@@ -33,6 +34,7 @@ jobs:
           #Strip the r/ prefix, giving us just 17.x.  If this is main/develop this does nothing
           echo "branch=${TEMP#r\/}" >> $GITHUB_OUTPUT
 
+
   deploy-main-branches:
     runs-on: ubuntu-latest
     needs: detect-repo-owner
@@ -91,6 +93,59 @@ jobs:
           git add assets
           git diff --staged --quiet || git commit --amend -m "Build $(date)"
 
-
       - name: Push updates
         run: git push origin gh-pages --force
+
+
+  file-upstream-admin-pr:
+    name: Create upstream admin PR to incorporate build
+    runs-on: ubuntu-latest
+    needs: detect-repo-owner
+    permissions:
+      contents: write  # For the release
+      pull-requests: write  # For the PR in the upstream repo
+
+    steps:
+      - name: Prepare git
+        run: |
+          git config --global user.name "Admin Interface Commit Bot"
+          git config --global user.email "cloud@opencast.org"
+
+      - name: Prepare GitHub SSH key
+        env:
+          DEPLOY_KEY: ${{ secrets.MODULE_PR_DEPLOY_KEY }}
+        run: |
+          install -dm 700 ~/.ssh/
+          echo "${DEPLOY_KEY}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan github.com >> ~/.ssh/known_hosts
+
+      - name: Clone upstream repository
+        run: |
+          git clone -b ${{ github.ref_name }} "git@github.com:${{ github.repository_owner }}/opencast.git" opencast
+          cd opencast
+          git checkout -b t/admin-$GITHUB_REF
+
+      - name: Update the admin submodule
+        working-directory: opencast
+        run: |
+          # Note: This could be a race condition in that rapid submodule pushes can trigger multiple PRs in short order
+          # and we don't have a guarantee that the update triggered by commit A does not end up finding commit B
+          # We are going to ignore this possibility since we almost universally want the *latest* commit, though this
+          # could end up causing the commit message, and the actual submodule hash to differ.
+          git submodule update --init --remote modules/admin-ui
+          git add modules/admin-ui
+          git commit -m "Updating admin-service to $GITHUB_REF"
+          git push origin t/admin-$GITHUB_REF
+          # This token is an account wide token which allows creation of PRs and pushes.
+          echo "${{ secrets.MODULE_PR_TOKEN }}" > token.txt
+          gh auth login --with-token < token.txt
+          gh pr create \
+            --title "Update ${{ needs.detect-repo-owner.outputs.branch }} Admin Interface to $GITHUB_REF" \
+            --body "Updating Opencast ${{ needs.detect-repo-owner.outputs.branch }} Admin Interface module to [$GITHUB_REF](https://github.com/${{ github.repository_owner }}/admin-interface/commit/$GITHUB_REF)" \
+            --head=${{ github.repository_owner }}:t/admin-$GITHUB_REF \
+            --base ${{ github.ref_name }} \
+            -R ${{ github.repository_owner }}/opencast
+            #FIXME: fine grained PATs can't apply labels
+            #FIXME: classic PATs don't have the permissions because the PR isn't in an opencastproject (the user) repo
+            #--label admin-ui --label maintenance \